mehrdadrad/mylg
Network Diagnostic Tool
- Repository: https://github.com/mehrdadrad/mylg
- Commit:
faba8672ef9f2693ca9093d2a3a671114401e55a - Generated: 2026-11-13T23:26:40+00:00
- Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 0 | none-detected | 65% | 100% |
| Code quality | 63 | weak | 90% | 100% |
| Security | 70 | weak | 85% | 100% |
AI provenance
No AI attribution or AI-consistent velocity signals detected.
- Explicitly attributed share (lower bound): 0.0%
- Unattributed share in AI-consistent velocity bursts: 0.0%
- Estimated AI-generated share: 0.0%
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2016-06 | 921 | 0% |
| 2016-07 | 4,600 | 0% |
| 2016-08 | 2,777 | 0% |
| 2016-09 | 4,019 | 0% |
| 2016-10 | 8,808 | 0% |
| 2016-11 | 1,452 | 0% |
| 2016-12 | 1,186 | 0% |
| 2017-03 | 3 | 0% |
| 2017-04 | 1 | 0% |
| 2017-08 | 1 | 0% |
| 2020-02 | 1 | 0% |
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is weak: test-to-source ratio 0.06, CI runs tests; 1% of function code in complex or long functions; 9% duplicated lines. Weakest area: type safety.
| Area | Score |
|---|---|
| Complexity (lizard) | 96 |
| Duplication | 59 |
| Code smells (Opengrep) | 92 |
| Tests and CI | 59 |
| Documentation | 65 |
| Type safety | 0 |
| Process (Scorecard review/maintenance) | 0 |
- Functions: 473; mean complexity 3.4, 90th percentile 8; 2 complex and 0 long functions
- Duplicated lines: 8.9% of 7,624 compared
- Tests: 599 test lines for 10,639 source lines (ratio 0.06); CI test commands: go test; 4% of recent source commits also change tests
- Docs missing or thin: contributing, changelog
Most complex functions:
- PrintPretty in icmp/trace.go: complexity 25, 62 lines
- Recv in icmp/trace.go: complexity 16, 45 lines
Security
Security posture is weak: 30 known vulnerabilities in 1 dependencies; 1 high-severity SAST findings. Weakest area: posture.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 100 |
| Static analysis (Opengrep) | 68 |
| Vulnerable dependencies (OSV) | 88 |
| CI workflows (zizmor) | n/a |
| Posture (policy, updates, signing, lockfiles) | 0 |
| OpenSSF Scorecard | 30 |
-
Known vulnerabilities: 30 in 1 packages (critical 0, high 4, medium 8, low 0)
-
Posture checks passed: none; missing: security policy, dependency updates, signed commits, lockfiles
-
OpenSSF Scorecard aggregate: 2.3/10 (published 2026-11-09)
Top findings
| Severity | Finding | Location |
|---|---|---|
| high | opengrep/dockerfile.security.missing-user: By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium] |
Dockerfile:5 |
| high | osv/GHSA-83g2-8m93-v3w7: golang.org/x/[email protected] (Go) is affected by GO-2021-0238, GHSA-83g2-8m93-v3w7 |
go.mod |
| high | osv/GHSA-69cg-p879-7622: golang.org/x/[email protected] (Go) is affected by GO-2022-0969, GHSA-69cg-p879-7622 |
go.mod |
| high | osv/GHSA-vvpx-j8f3-3w6h: golang.org/x/[email protected] (Go) is affected by GO-2023-1571, GHSA-vvpx-j8f3-3w6h |
go.mod |
| high | osv/GHSA-4374-p667-p6c8: golang.org/x/[email protected] (Go) is affected by GO-2023-2102, GHSA-4374-p667-p6c8 |
go.mod |
| medium | opengrep/go.lang.security.audit.unsafe-reflect-by-name: If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to [confidence low] |
cli/config.go:330 |
| medium | opengrep/go.lang.security.bad-tmp-file-creation: File creation in shared tmp directory without using ioutil.Tempfile [confidence low] |
disc/disc.go:362 |
| medium | opengrep/go.lang.security.audit.crypto.missing-ssl-minversion: MinVersion is missing from this TLS configuration. By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all other protocols disabled. Only where it is known that a web se [confidence high] |
http/ping/ping.go:312 |
| medium | opengrep/go.lang.security.audit.crypto.math-random-used: Do not use math/rand. Use crypto/rand instead. [confidence medium] |
icmp/icmp.go:9 |
| medium | opengrep/go.lang.security.audit.crypto.math-random-used: Do not use math/rand. Use crypto/rand instead. [confidence medium] |
icmp/ping.go:10 |
| medium | opengrep/go.lang.security.audit.crypto.math-random-used: Do not use math/rand. Use crypto/rand instead. [confidence medium] |
icmp/trace.go:11 |
| medium | opengrep/go.lang.security.shared-url-struct-mutation: Shared URL struct may have been accidentally mutated. Ensure that this behavior is intended. [confidence low] |
lg/cogent.go:32 |
| medium | opengrep/go.lang.security.shared-url-struct-mutation: Shared URL struct may have been accidentally mutated. Ensure that this behavior is intended. [confidence low] |
lg/kpn.go:29 |
| medium | opengrep/go.lang.security.shared-url-struct-mutation: Shared URL struct may have been accidentally mutated. Ensure that this behavior is intended. [confidence low] |
lg/level3.go:51 |
| medium | opengrep/go.lang.security.shared-url-struct-mutation: Shared URL struct may have been accidentally mutated. Ensure that this behavior is intended. [confidence low] |
lg/level3.go:54 |
| medium | opengrep/go.lang.security.shared-url-struct-mutation: Shared URL struct may have been accidentally mutated. Ensure that this behavior is intended. [confidence low] |
lg/ntt.go:29 |
| medium | opengrep/go.lang.security.shared-url-struct-mutation: Shared URL struct may have been accidentally mutated. Ensure that this behavior is intended. [confidence low] |
lg/telia.go:30 |
| medium | opengrep/go.lang.security.bad-tmp-file-creation: File creation in shared tmp directory without using ioutil.Tempfile [confidence low] |
ns/ns.go:319 |
| medium | opengrep/go.lang.security.audit.crypto.math-random-used: Do not use math/rand. Use crypto/rand instead. [confidence medium] |
scan/scan.go:7 |
| medium | opengrep/go.lang.security.audit.xss.no-fprintf-to-responsewriter: Detected 'Fprintf' or similar writing to 'http.ResponseWriter'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users. [confidence low] |
services/httpd/geo.go:55 |
| medium | opengrep/go.lang.security.audit.net.use-tls: Found an HTTP server without TLS. Use 'http.ListenAndServeTLS' instead. See https://golang.org/pkg/net/http/#ListenAndServeTLS for more information. [confidence medium] |
services/httpd/httpd.go:81 |
| medium | opengrep/go.lang.security.audit.xss.no-fprintf-to-responsewriter: Detected 'Fprintf' or similar writing to 'http.ResponseWriter'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users. [confidence low] |
services/httpd/ping.go:19 |
| medium | opengrep/go.lang.security.audit.xss.no-fprintf-to-responsewriter: Detected 'Fprintf' or similar writing to 'http.ResponseWriter'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users. [confidence low] |
services/httpd/ping.go:33 |
| medium | opengrep/go.lang.security.audit.crypto.math-random-used: Do not use math/rand. Use crypto/rand instead. [confidence medium] |
services/httpd/trace.go:5 |
| medium | opengrep/go.lang.security.audit.xss.no-fprintf-to-responsewriter: Detected 'Fprintf' or similar writing to 'http.ResponseWriter'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users. [confidence low] |
services/httpd/trace.go:23 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Repository profile
- Source lines: 10,639; test lines: 599
| Language | Lines |
|---|---|
| Go | 10,232 |
| TypeScript | 689 |
| JavaScript | 317 |